[PATCH v3] libbpf: initialize btf_ext out-parameter early in btf_parse_elf()

[Naveed Khan <naveed@digiscrypt.com>]

btf_parse_elf() only stores to *btf_ext once it reaches the .BTF.ext
parsing step.  If the function fails before that point (open() aside,
e.g. elf_begin() failure, missing .BTF section, or a malformed .BTF /
.BTF.base section), the cleanup path still runs

	if (btf_ext)
		btf_ext__free(*btf_ext);

and reads a value that was never written.  A caller that passes an
uninitialized pointer, e.g.

	struct btf_ext *ext;
	btf = btf__parse_elf(path, &ext);

ends up with btf_ext__free() operating on stack garbage, which can
crash or corrupt the heap.  Current in-tree callers happen to
NULL-initialize their pointer, but the API contract should not rely
on that.

Initialize *btf_ext to NULL on entry so every exit path leaves the
out-parameter in a defined state.

Note that the similar initialization in btf_parse() is intentionally
kept: btf_parse() returns without ever calling btf_parse_elf() when
btf_parse_raw() succeeds (raw BTF file, no .BTF.ext) or fails with an
error other than -EPROTO, so its own initialization is what defines
*btf_ext for btf__parse() callers on those paths.

Reported-by: sashiko-bot@kernel.org
Signed-off-by: Naveed Khan <naveed@digiscrypt.com>
---
 tools/lib/bpf/btf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 823bce8951..cabe8286f0 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -1453,6 +1453,9 @@ static struct btf *btf_parse_elf(const char *path, struct btf *base_btf,
 	int err = 0, fd = -1;
 	Elf *elf = NULL;
 
+	if (btf_ext)
+		*btf_ext = NULL;
+
 	if (elf_version(EV_CURRENT) == EV_NONE) {
 		pr_warn("failed to init libelf for %s\n", path);
 		return ERR_PTR(-LIBBPF_ERRNO__LIBELF);